fix: properly escape reveal markdown script tag with case-insensitive regex [Security Issue]

jackycute · jackycute · commit 9291a7670a3b · 2021-01-21T13:24:48.000+08:00
Signed-off-by: Max Wu &lt;jackymaxj@gmail.com&gt;
diff --git a/public/js/reveal-markdown.js b/public/js/reveal-markdown.js
@@ -103,7 +103,7 @@ import { md } from './extra'
 
     // prevent script end tags in the content from interfering
     // with parsing
-    content = content.replace(/<\/script>/g, SCRIPT_END_PLACEHOLDER)
+    content = content.replace(/<\/script>/gi, SCRIPT_END_PLACEHOLDER)
 
     return '<script type="text/template">' + content + '</script>'
   }

Original file line number	Diff line number	Diff line change
`@@ -103,7 +103,7 @@ import { md } from './extra'`
`103`	`103`
`104`	`104`	`// prevent script end tags in the content from interfering`
`105`	`105`	`// with parsing`
`106`		`- content = content.replace(/<\/script>/g, SCRIPT_END_PLACEHOLDER)`
	`106`	`+ content = content.replace(/<\/script>/gi, SCRIPT_END_PLACEHOLDER)`
`107`	`107`
`108`	`108`	`return '<script type="text/template">' + content + '</script>'`
`109`	`109`	`}`